we are hit by a strange attack, the attacker even emailed to challenge us.
The output of "netstat -n" is just a few "ESTABLISHED" and "TIME_WAIT" typically, yet the server's website cannot be reached from outside. And when typing "ssh 127.0.0.1" on the Console window, it takes almost a minute to get the prompt for password. CPU and memory usage are very low.
The output of "tcpdump -l" averages merely a few lines per second. Most of them are TCP connection with "S" or "R" flags from port 80 of this web server to some remote ips. Strangely, these IPs do not show in the output of "netstat -n"! And these IPs are similar to other ips the attacker used before.
And the symptom (with delayed ssh to 127.0.0.1) will even last after I completely unplug the server from network. Only after around 10 minutes will the symptom suddenly disappear. And this behavior can be repeated.
The server is behind a hardware firewall, that only allows TCP connection to this web server. Is there something that I didn't know, ie, is there some way to let the server remember some TCP requests, which doesn't show by netstat, yet will tie the server resources, so it can hardly handle any subsequent TCP requests?